From 481532153fa4a2ba9ce3dd283702489c7f037761 Mon Sep 17 00:00:00 2001 From: Giuseppe Longo Date: Mon, 22 Dec 2025 14:57:48 +0100 Subject: [PATCH] tests: add test for mac swapping --- tests/mac-eve-multiple-swap/README.md | 12 ++++++++++++ tests/mac-eve-multiple-swap/suricata.yaml | 11 +++++++++++ tests/mac-eve-multiple-swap/test.yaml | 17 +++++++++++++++++ 3 files changed, 40 insertions(+) create mode 100644 tests/mac-eve-multiple-swap/README.md create mode 100644 tests/mac-eve-multiple-swap/suricata.yaml create mode 100644 tests/mac-eve-multiple-swap/test.yaml diff --git a/tests/mac-eve-multiple-swap/README.md b/tests/mac-eve-multiple-swap/README.md new file mode 100644 index 000000000..daee430e3 --- /dev/null +++ b/tests/mac-eve-multiple-swap/README.md @@ -0,0 +1,12 @@ +# Test + +Test that src_macs and dest_macs are swapped when a flow is reverted + +# Ticket + +https://redmine.openinfosecfoundation.org/issues/8172 + +# Pcap + +dns-reverted-tcp-1/dns.pcap + diff --git a/tests/mac-eve-multiple-swap/suricata.yaml b/tests/mac-eve-multiple-swap/suricata.yaml new file mode 100644 index 000000000..cef8a0da4 --- /dev/null +++ b/tests/mac-eve-multiple-swap/suricata.yaml @@ -0,0 +1,11 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + ethernet: yes + types: + - flow diff --git a/tests/mac-eve-multiple-swap/test.yaml b/tests/mac-eve-multiple-swap/test.yaml new file mode 100644 index 000000000..6eb5ed70d --- /dev/null +++ b/tests/mac-eve-multiple-swap/test.yaml @@ -0,0 +1,17 @@ +pcap: ../dns-reversed-tcp-1/dns.pcap + +requires: + min-version: 9 + +args: + - --set stream.midstream=true + +checks: + - filter: + count: 1 + match: + event_type: flow + src_ip: "10.16.1.11" + ether.src_macs: ["d8:cb:8a:ed:a1:46"] + dest_ip: "8.8.4.4" + ether.dest_macs: ["00:15:17:0d:06:f7"] -- 2.47.3